A service chain includes a sequence of service function instances that reside on various network nodes. When a traffic flow is forwarded over a service chain, packets in the traffic flow are processed by the various service function instances, with each service function instance applying a service function (e.g., firewall, network access translation (NAT), deep packet inspection (DPI), etc.) prior to forwarding the packets to the next network node. In some implementations, a service function instance may need to inspect certain fields on packets of a traffic flow to perform the function, or to determine whether the function needs to be performed on the traffic flow. As one example, a service function instance performing firewall processing may determine that a flow is benign based on the packets received. As another example, a service function instance performing DPI processing may need to inspect packets of a traffic flow to extract the identification information. As yet another example, a service function instance performing content delivery network (CDN) caching may learn that content in a traffic flow does not satisfy a caching criteria, at which point there is no processing (e.g., caching) to be performed on the packets. A service function chaining generally applies a sequence of service functions to a traffic flow in a specific order and layer 4-7 service functions are inserted on a data-forwarding path between communicating peers in common deployment model. Those service functions typically are placed in centralized location, for example next to a data center gateway, through which all traffic traverses.